PT-2014-3140 · Icedtea+1 · Icedtea-Web+1

Murray Mcallister · Publicado 2014-02-10 · Atualizado 2014-03-19 · CVE-2013-6493

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IcedTea-Web versions prior to 1.4.2

Description The issue affects the LiveConnect implementation, allowing local users to intercept communication between a Java applet and a web browser. This is achieved by pre-creating a temporary socket file with a predictable name in /tmp, enabling the user to read the messages exchanged between the applet and the browser.

Recommendations For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-6493

MGASA-2014-0049

SUSE-SU-2014_0397-1

Produtos afetados

Icedtea-Web

Suse

Referências · 21

• 🔥 http://icedtea.classpath.org/hg/icedtea-web/rev/228e3652214a · Exploit
• http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-February/026192.html · Nota
• https://advisories.mageia.org/MGASA-2014-0049.html · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=12654 · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2014-March/000755.html · Nota
• https://lists.fedoraproject.org/pipermail/package-announce/2014-February/127944.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-6493 · Nota de Segurança
• http://ubuntu.com/usn/USN-2131-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6493 · Nota de Segurança
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• http://support.novell.com/security/cve/CVE-2013-6493.html · Nota
• http://secunia.com/advisories/57036 · Aviso do Fabricante
• http://download.suse.com/patch/finder/?keywords=6aa1fad869d16e905d455574f086e576 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1010958 · Nota
• https://osv.dev/vulnerability/CVE-2013-6493 · Aviso do Fabricante